CVE-2026-73408: 
JavaScript vulnerability analysis and mitigation

CVE-2026-73408 is a SQL injection vulnerability in Budibase's MySQL database connector, specifically a backtick injection via stacked statements during schema discovery. The flaw exists in packages/server/src/integrations/mysql.ts and affects all Budibase versions prior to 3.39.18. It was disclosed on August 13, 2026, and carries a CVSS v3.1 base score of 7.6 (High) (GitHub Advisory). This vulnerability is related to but distinct from a companion PostgreSQL injection issue (GHSA-qqf5-x7mj-v43p), split per GitHub CNA guidance as it affects a separate integration with a different attack precondition (GitHub Advisory).

The root cause (CWE-89: SQL Injection) lies in two compounding design choices in mysql.ts: the MySQL connection is initialized with multipleStatements: true, and table names retrieved from INFORMATION_SCHEMA.TABLES are interpolated directly into a DESCRIBE query wrapped in backticks without any escaping — DESCRIBE \${tableName}`;([GitHub Advisory](https://github.com/Budibase/budibase/security/advisories/GHSA-2xgg-r2wc-c5r2)). An attacker who can create a MySQL table with a maliciously crafted name (e.g.,foo`; DROP TABLE users; --) can break out of the backtick identifier and append an arbitrary second SQL statement. Exploitation requires the attacker to have table-creation privileges in the target MySQL database and then wait for a Budibase administrator to trigger schema introspection (e.g., opening or refreshing the datasource). The fix replaces the raw interpolation with a call to quoteMySqlIdentifier()`, which escapes embedded backticks by doubling them (GitHub Commit).

Successful exploitation allows arbitrary SQL statement execution on the connected MySQL database, triggered silently during a routine administrator action. The impact spans high confidentiality (data exfiltration), high integrity (data modification or deletion, e.g., DROP TABLE), and high availability (destruction of database objects), with scope change indicating potential impact beyond the Budibase application itself (GitHub Advisory). Unlike direct configuration-based injection flaws, this attack does not require the attacker to control Budibase datasource settings — only the ability to create a specially named table in the underlying database beforehand.

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is 0.0, indicating a currently low probability of active exploitation (ENISA EUVD). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high privileges (table creation in the target MySQL database) and user interaction (an administrator must trigger schema discovery), which significantly limits the attacker pool (GitHub Advisory).

1. Gain database access: Obtain credentials for a lower-privileged MySQL user account that has CREATE TABLE privileges on a database connected to the target Budibase instance.
2. Create a malicious table: Using a MySQL client, create a table with a name containing a backtick and a stacked SQL payload, for example:

   CREATE TABLE `foo\`; DROP TABLE sensitive_data; -- ` (id INT);

3. Wait for schema discovery: Monitor or socially engineer a Budibase administrator to open the datasource in the Budibase UI or trigger a schema refresh, which causes Budibase to query INFORMATION_SCHEMA.TABLES and then issue DESCRIBE for each table name.
4. Payload executes: Budibase interpolates the malicious table name into DESCRIBE \foo`; DROP TABLE sensitive_data; --`;, and because multipleStatements: true is set on the connection, the second statement (DROP TABLE sensitive_data`) executes as a separate query on the MySQL server.
5. Achieve objective: The injected statement runs with the privileges of the MySQL user configured in the Budibase datasource, enabling data exfiltration, modification, or destruction (GitHub Advisory).

• Database Logs: MySQL general query log entries showing DESCRIBE statements that contain semicolons, additional SQL keywords (DROP, CREATE, SELECT, INSERT), or comment sequences (--, #) within backtick-quoted identifiers.
• Database Logs: Unexpected DDL or DML operations (e.g., DROP TABLE, CREATE TABLE, SELECT ... INTO OUTFILE) executed by the Budibase database service account in close temporal proximity to schema introspection events.
• Application Logs: Budibase server logs showing errors or unexpected results during datasource schema fetch operations, particularly for table names containing special characters.
• Database State: Presence of unexpected tables (e.g., marker tables created as part of a test payload) or missing tables that were unexpectedly dropped in databases connected to Budibase.
• Network: Unusual outbound connections from the MySQL server host following schema discovery events, which could indicate data exfiltration via SELECT ... INTO OUTFILE or LOAD DATA abuse.

Upgrade Budibase to version 3.39.18 or later, which applies quoteMySqlIdentifier() to properly escape backticks in table names before constructing DESCRIBE queries (GitHub Release, GitHub Commit). Note that the GitHub Security Advisory lists the patched version as 3.40.0, so upgrading to the latest available release is recommended. As a workaround where immediate upgrade is not possible, restrict the MySQL user account configured in Budibase datasources to the minimum necessary privileges (e.g., SELECT only) and avoid granting CREATE TABLE or DDL privileges to any untrusted users on databases connected to Budibase (GitHub Advisory).

The vulnerability was reported by security researcher mhr-isham and credited in the GitHub Security Advisory (GitHub Advisory). The Budibase team addressed the issue promptly via pull request #18989, merged on June 16, 2026, alongside fixes for related SQL injection issues in PostgreSQL and MS SQL Server connectors (GitHub PR). No significant broader media coverage or notable community commentary beyond the official advisory has been identified.